Overview: Migration Scenario for SIMATIC S7-400
Replacing a SIMATIC S7-400 CPU 416-2 DP with a CPU 414-3 PN/DP is a common standardization move when maintenance teams consolidate spare-part inventories across plants. Both CPUs belong to the S7-400 family, execute the same STEP 7 instruction set, and share the same backplane and signal-module footprint, so the migration is mechanically trivial. The engineering risk lies entirely in resource deltas: the smaller CPU offers roughly half the work memory, half the bit memory, and half the addressable I/O area of the larger one. A project that compiles cleanly on a CPU 416-2 DP will not necessarily compile, link, or run on a CPU 414-3 PN/DP without explicit verification.
Siemens addresses this concern directly in the support entry "What should you watch out for when changing from one S7-400 CPU to another?" (Siemens ID 25208203). The article below operationalizes that guidance for the specific CPU 416-2 DP → CPU 414-3 PN/DP swap and adds the field-proven checks that catch the resource regressions before commissioning.
CPU Identification and Order Numbers
Before any migration, identify the exact MLFB (Siemens order number) of both units. The S7-400 catalog includes several firmware generations of each CPU; specifications and permissible OB set differ across them.
| CPU | Typical MLFB | Firmware | Role in Migration |
|---|---|---|---|
| CPU 414-3 PN/DP | 6ES7414-3EM07-0AB0 | V7.0 or later | Target (replacement) |
| CPU 414-3 PN/DP | 6ES7414-3EM06-0AB0 | V6.0 | Target (legacy) |
| CPU 416-2 DP | 6ES7416-2XN05-0AB0 | V5.x | Source (existing) |
| CPU 416-2 DP | 6ES7416-2XP05-0AB0 | V5.x / V6.x | Source (variant) |
Memory Capacity Comparison
The single largest constraint on a 416 → 414 swap is work memory. STEP 7 partitions user memory into code (loaded blocks plus their run-time data for code-only blocks) and data (DB contents, instance DBs). The CPU 414-3 PN/DP offers roughly half of each, which becomes binding as soon as the STEP 7 compiler reports "Memory area exceeded" warnings.
| Parameter | CPU 414-3 PN/DP (EM07) | CPU 416-2 DP (XN05) | Delta |
|---|---|---|---|
| Work memory, code | 2 MB | 2.8 MB | -0.8 MB (~29 %) |
| Work memory, data | 2 MB | 2.8 MB | -0.8 MB |
| Load memory (RAM + Flash) | 4 MB integrated | 8 MB integrated | -4 MB |
| Bit memory (M) | 8 KB | 16 KB | -8 KB |
| S7 timers (T) | 512 | 1024 | -512 |
| S7 counters (C) | 512 | 2048 | -1536 |
| Max DBs | 2048 | 4096 | -2048 |
| Max FB / FC | 2048 / 2048 | 4096 / 4096 | halved |
Calculate the consumed code/data sizes in advance:
- In SIMATIC Manager, right-click the S7 Program node → Object Properties → Blocks.
- Add the Required Work Memory of each block.
- Compare the totals against the Available column for the CPU 414-3 PN/DP.
- If totals exceed 70 % of available memory, plan a memory-optimization pass (DB packing, removing unused FBs/FCs, switching to multi-instance DBs).
I/O Address Area: The 8 KB vs. 16 KB Constraint
The CPU 416-2 DP supports a 16 KB input address area and a 16 KB output address area; the CPU 414-3 PN/DP supports only 8 KB of each. Address ranges in STEP 7 are mapped per rack / station / slot and aggregated across the entire station. The 8 KB boundary is therefore a hard limit that STEP 7 enforces during Save and Compile in HW Config.
How to Measure Current I/O Consumption
- Open HW Config for the CPU 416-2 DP project.
- For each slot/DP slave/IO device, expand the I addresses and Q addresses columns and record the highest byte used in the lowest and highest directions.
- Sum the input ranges (highest byte + 1) and the output ranges. The CPU 414-3 PN/DP will only accept totals ≤ 8192 bytes per direction.
- Repeat the check in LAD/FBD/STL Editor → Options → Address Overview to capture all symbolic I/O access points; this catches addresses generated by indirect PEB/PAB access.
If the CPU 416-2 DP station already consumes more than 8 KB in either direction, the swap is impossible without re-architecting the I/O layout (sub-DP segmentation, second station, or PN/IO line).
Process Image Configuration and Limits
The process image is the I/O and memory area the operating system refreshes automatically every OB1 cycle. It is a configurable subset of the full I/O address area. For the S7-400, the default process image for both CPUs is 512 bytes per direction, but the parameter is adjustable from 0 to 16 KB in HW Config → CPU → Properties → Cycle / Clock Memory.
L PIW / written with T PQW (or via SFCs 26/27). When migrating to the smaller CPU, lowering the process image size without auditing all I / Q accesses in the program is the most common source of "mystery" field-bus faults.The CPU 414-3 PN/DP supports a process-image size up to 16 KB per direction — equal to the CPU 416-2 DP — so this parameter itself is not the binding constraint. However, the CPU Properties dialog differs slightly in presentation between firmware versions; always read the value the CPU reports after download (Online → CPU Information → Memory).
Bit Memory, Timers, and Counters
The CPU 414-3 PN/DP retains the same 8 KB bit-memory addressable range (MB 0 – MB 8191), but only 8 KB of that range is retained across power-cycle by default. If the CPU 416-2 DP project uses more than 8 KB of M-flags or relies on retain > 8 KB, configure retain in HW Config → CPU → Properties → Retentive Memory.
For timers and counters, the same principle applies:
- Timers (T): CPU 414 supports 512, CPU 416 supports 1024. STEP 7 will refuse to load if the project references more.
- Counters (C): CPU 414 supports 512, CPU 416 supports 2048. The IEC counters (SFB 0/1/2/3/4) bypass this limit and are recommended for new code.
OB Compatibility Matrix
Most OBs are supported identically. The deltas appear in OB 80/82/83/85 (error OBs) and OB 121/122 (programming-error OBs). Use the table below as a pre-checklist.
| OB | Function | CPU 414-3 PN/DP | CPU 416-2 DP |
|---|---|---|---|
| OB 1 | Main cyclic | Yes | Yes |
| OB 10–17 | Time-of-day | Yes | Yes |
| OB 20–23 | Time-delay | Yes | Yes |
| OB 30–38 | Cyclic interrupt | Yes | Yes |
| OB 40–47 | Hardware interrupt | Yes | Yes |
| OB 55–57 | DPR / DPV1 | Yes | Yes |
| OB 80 | Time error | Yes | Yes |
| OB 82 | Diagnostic interrupt | Yes | Yes |
| OB 83 | Insert/remove | Yes | Yes |
| OB 85 | Priority-class error | Yes | Yes |
| OB 100/101/102 | Startup | Yes | Yes |
| OB 121/122 | Programming error | Yes | Yes |
Listing every OB used in the project is the only safe audit. In SIMATIC Manager use Options → Cross References → OB Selection.
Communication Interface Differences: DP vs. PN/DP
The CPU 416-2 DP exposes one combined MPI/DP port and one DP port. The CPU 414-3 PN/DP replaces the second DP port with a PROFINET port. This is the largest functional change in the migration and demands attention in three areas:
- Distributed I/O topology: PROFIBUS DP slaves attached to the second port of the CPU 416-2 DP must be re-homed — either to the remaining DP port (master reset) or migrated to PROFINET via a GSDML import. CPU 414-3 PN/DP can act as PROFINET IO Controller but not as PROFINET IO Device; existing PN-Device configurations must move upstream to an ET 200S/ET 200SP PN station.
- S7 communication: PG/OP routes on the MPI/DP port work identically. S7 connections via the DP port need to be recreated against the new PN interface.
- IP addressing: Configure the PN port with a fixed IP, subnet, and (if used) router in HW Config → PN Interface → Properties → Ethernet Parameters. PROFINET device names are case-sensitive and must match the topology editor.
STEP 7 Hardware Reconfiguration Procedure
Prerequisites
- STEP 7 V5.5 + SPx (or TIA Portal V16+) installed with HW catalog ≥ firmware version of both CPUs.
- Offline archive of the current CPU 416-2 DP project.
- Engineering cable (MPI/USB or PN).
Procedure
- Open project containing the CPU 416-2 DP station.
- Replace CPU: right-click the CPU in HW Config → Replace Object → CPU → select CPU 414-3 PN/DP at the exact order number / firmware level you have on the shelf.
- Compile: Station → Save and Compile. STEP 7 emits warnings whenever a parameter drops below the original CPU's spec; treat every warning as a hard error until verified.
- Resolve I/O overflow: if compile fails on I/O address area, redistribute slaves across the remaining DP port or convert to PN/IO.
- Adjust retain: CPU Properties → Retentive Memory → set M / T / C ranges to match the original project (bounded by the CPU 414 limits).
- Adjust process image: keep the same Process Image Size value as the original project to preserve auto-refresh behaviour.
- Add PROFINET configuration if required: import GSDML, place IO-Devices, assign device names.
- Download: PLC → Download after powering down and physically swapping the CPU module.
- Cold restart: issue a Complete Restart (cold) via PLC → Operating Mode to initialize work memory and clear any diagnostic interrupts from the topology change.
Verification and Commissioning Steps
- Online → CPU Information → Memory: confirm code/data usage below the new CPU's max.
- Online → Accessible Nodes: verify PN and DP slaves come online with the expected diagnostic state.
- Variable Table / Watch Table: force I/O bytes at the extreme addresses (e.g., IB 8191 and QB 8191 on the CPU 414 side) to prove boundary access works.
- Run the application through one full OB 1 cycle and inspect OB 100 start-up info for unexpected restart events.
- Capture a Diagnostic Buffer dump before and after swap for the maintenance log.
Troubleshooting Matrix
| Symptom | Likely Cause | Resolution |
|---|---|---|
| STEP 7 rejects download: "CPU does not support required work memory" | Total code + data > 4 MB | Optimize block sizes, remove unused FBs/FCs, consolidate DBs |
| DP slave goes to "Station failure" after CPU swap | Master port assignment lost during CPU change | Re-assign DP master system to interface X2 in HW Config |
| Inputs read stale data on first scan | Process image size reduced | Restore original process-image size in CPU Properties |
| Retain values lost on power cycle | Retain range larger than 8 KB | Reduce retain M/T/C to fit CPU 414 limits |
| S7 connection via second port fails | Second port changed from DP to PN | Re-establish connection using PN interface MAC/IP |
| OB 85 events logged at startup | Unmapped I/O accessed by old code | Audit I/Q access against new process-image size |
| CPU stays in STOP after download | Startup OB or HW Config error | Check diagnostic buffer, verify OB 100 present, check rack consistency |
Standardization Notes for Spare-Pool Strategy
Standardizing on CPU 414-3 PN/DP as a universal spare is viable only for the subset of stations whose resource consumption fits within 8 KB I/O per direction, 8 KB M-flags, 4 MB work memory, and 512 timers / 512 counters. Larger or distributed-heavy stations must remain on the 416 class or move to CPU 417. A pragmatic field practice is to maintain a project metric sheet per station:
- Highest input byte (decimal)
- Highest output byte (decimal)
- Total code memory (KB)
- Total data memory (KB)
- Retain M-range, T-range, C-range
- Process image size (bytes)
- Number and types of OBs used
- Interface usage: DP master ports, PN devices
With this sheet, a controller swap becomes a paper exercise instead of a fire drill. Refer to Siemens Support entry 25208203 as the canonical checklist whenever a station is upgraded or downgraded across the S7-400 range.
Can I directly swap a CPU 416-2 DP with a CPU 414-3 PN/DP without changing the STEP 7 project?
No. The mechanical swap is straightforward, but the STEP 7 project must be re-compiled against the new CPU so that HW Config, retain ranges, and process image are resized to fit the CPU 414's 8 KB I/O area, 8 KB bit memory, and 4 MB total work memory. Otherwise download fails or the CPU enters STOP.
What is the maximum I/O address area of each CPU?
The CPU 414-3 PN/DP supports 8 KB of inputs and 8 KB of outputs (bytes 0–8191 per direction). The CPU 416-2 DP supports 16 KB per direction. STEP 7 enforces this limit during Save and Compile in HW Config.
How do I check the actual I/O and process-image usage of an existing CPU 416-2 DP project?
Open HW Config and read the highest I-address and Q-address per slot, then sum them. Open Options → Address Overview in the LAD/FBD/STL editor to capture all symbolic I/O accesses. Compare the totals against the CPU 414's 8 KB limit per direction and the configured Process Image Size in CPU Properties.
What happens if my project exceeds the 8 KB I/O limit on the CPU 414-3 PN/DP?
STEP 7 rejects Save and Compile. Re-architect the I/O topology: split the station into two, redistribute slaves across the remaining DP port, or convert DP slaves to PROFINET IO devices on the PN interface.
Do I need to update STEP 7 hardware configuration when changing CPU?
Yes. Right-click the CPU in HW Config and choose Replace Object → CPU, select the exact CPU 414-3 PN/DP order number and firmware, then Save and Compile. The tool resets interface parameters, retain areas, and process-image size to the new CPU's defaults, which must be re-tuned to match the original application.